{"id":"CVE-2026-15244","title":"The HUSKY  WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and …","summary":"The HUSKY  WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and …","severity":"none","published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15244","references":[{"url":"https://wpscan.com/vulnerability/7384ebb7-a581-45c7-ab48-0fdf30a1569d/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00702,"epssPercentile":0.51816,"ingestedAt":"2026-08-02T05:17:47.626Z","slug":"CVE-2026-15244","body":"## Overview\n\nThe HUSKY  WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}